Method for preventing key share attacks

Abstract

A key agreement protocol for preventing key-share attacks wherein a method is provided for establishing a common shared key between a pair of correspondents in a station-to-station protocol by exchanging messages between the correspondents and including identification information in said messages, the information being identifiable to one or other of said correspondents to thereby establish said common key.

Description

This invention relates to cryptographic systems and in particular, to improvements in key agreement protocols for preventing key-share attacks thereon.BACKGROUND OF THE INVENTIONKey establishment is the process by which two (or more) entities establish a shared secret key.The key is subsequently used to achieve some cryptographic goal, such as confidentiality or data integrity. Ideally, the established key should have precisely the same attributes as a key established face-to-face it should be distributed uniformly at random from the key space, and no unauthorized (and computationally bounded) entity should learn anything about the key.Broadly speaking, there are two kinds of key establishment protocols: key transport protocols in which a key is created by one entity and securely transmitted to the second entity, and key agreement protocols in which both parties contribute information which jointly establish the shared secret key.Let A and B be two honest entities, i.e., legitimate ...

AI Technical Summary

Benefits of technology

The invention provides a way to prevent online attacks using a key agreement protocol. The protocol includes the identities of the sender and intended receiver, as well as a flow number in the message being signed. This helps to minimize the risk of a man-in-the-middle attack. The invention also includes the use of implicit key confirmation and the inclusion of the identities of entities in the key derivation function, rather than the signed message. The technical effects of this invention include improved security and protection against online attacks.

Problems solved by technology

It should be noted, however, that these protocols cannot be considered minor variants of STS.

For this reason, the above hypothetical scenario (in particular, the assumption that no further authentication is performed after termination of the key agreement protocol) is realistic if an AKC protocol is used (since key confirmation has already been provided), an unrealistic if an AK protocol is used (since key confirmation has not yet been provided).

Hence, unlike the case of public key substitution attacks, the on-line attacks cannot be prevented by requiring that entities prove to the certificate-issuing authority possession of the private keys corresponding to their public keys during the certification process.

The applicants have discovered that the STS protocols have some security attributes that are lacking.

Images